Alternatives and similar repositories for wsb-detect:

Users that are interested in wsb-detect are comparing it to the libraries listed below

• bats3c / Ghost-In-The-Logs
  Evade sysmon and windows event logging
  ☆615Updated 4 years ago
• monoxgas / Koppeling
  Adaptive DLL hijacking / dynamic export forwarding
  ☆745Updated 4 years ago
• hasherezade / transacted_hollowing
  Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging
  ☆531Updated last year
• LloydLabs / delete-self-poc
  A way to delete a locked file, or current running executable, on disk.
  ☆514Updated 7 months ago
• forrest-orr / phantom-dll-hollower-poc
  Phantom DLL hollowing PoC
  ☆356Updated 2 years ago
• hasherezade / process_ghosting
  Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted fi…
  ☆647Updated last year
• sailay1996 / UAC_Bypass_In_The_Wild
  Windows 10 UAC bypass for all executable files which are autoelevate true .
  ☆638Updated 5 years ago
• xuanxuan0 / DripLoader
  Evasive shellcode loader for bypassing event-based injection detection (PoC)
  ☆749Updated 3 years ago
• med0x2e / SigFlip
  SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature…
  ☆1,130Updated last year
• aaaddress1 / PR0CESS
  some gadgets about windows process and ready to use :)
  ☆583Updated last year
• RedSection / OffensivePH
  OffensivePH - use old Process Hacker driver to bypass several user-mode access controls
  ☆329Updated 3 years ago
• antonioCoco / Mapping-Injection
  Just another Windows Process Injection
  ☆391Updated 4 years ago
• sh4hin / GoPurple
  Yet another shellcode runner consists of different techniques for evaluating detection capabilities of endpoint security solutions
  ☆482Updated 3 years ago
• med0x2e / ExecuteAssembly
  Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR AppDomainManager, Stomping Loader/.NET assembly PE DOS head…
  ☆555Updated 3 years ago
• FSecureLABS / Ninjasploit
  A meterpreter extension for applying hooks to avoid windows defender memory scans
  ☆243Updated 4 years ago
• itm4n / Perfusion
  Exploit for the RpcEptMapper registry key permissions vulnerability (Windows 7 / 2088R2 / 8 / 2012)
  ☆416Updated 3 years ago
• outflanknl / Ps-Tools
  Ps-Tools, an advanced process monitoring toolkit for offensive operations
  ☆339Updated 4 years ago
• AzAgarampur / byeintegrity-uac
  Bypass UAC by hijacking a DLL located in the Native Image Cache
  ☆214Updated 3 years ago
• D4stiny / spectre
  A Windows kernel-mode rootkit that abuses legitimate communication channels to control a machine.
  ☆693Updated 4 years ago
• br-sn / CheekyBlinder
  Enumerating and removing kernel callbacks using signed vulnerable drivers
  ☆552Updated 2 years ago
• wietze / windows-dll-hijacking
  Project for identifying executables and DLLs vulnerable to relative path DLL hijacking.
  ☆457Updated 10 months ago
• deepinstinct / LsassSilentProcessExit
  Command line interface to dump LSASS memory to disk via SilentProcessExit
  ☆444Updated 4 years ago
• hfiref0x / WDExtract
  Extract Windows Defender database from vdm files and unpack it
  ☆436Updated 5 years ago
• hasherezade / module_overloading
  A more stealthy variant of "DLL hollowing"
  ☆341Updated last year
• nccgroup / nccfsas
  Information released publicly by NCC Group's Full Spectrum Attack Simulation (FSAS) team.
  ☆608Updated 2 years ago
• joshfaust / Alaris
  A protective and Low Level Shellcode Loader that defeats modern EDR systems.
  ☆902Updated 11 months ago
• RedSiege / EXCELntDonut
  Excel 4.0 (XLM) Macro Generator for injecting DLLs and EXEs into memory.
  ☆509Updated 4 years ago
• C-Sto / BananaPhone
  It's a go variant of Hells gate! (directly calling windows kernel functions, but from Go!)
  ☆497Updated 2 years ago
• hoangprod / AndrewSpecial
  AndrewSpecial, dumping lsass' memory stealthily and bypassing "Cilence" since 2019.
  ☆385Updated 5 years ago
• optiv / Dent
  A framework for creating COM-based bypasses utilizing vulnerabilities in Microsoft's WDAPT sensors.
  ☆297Updated last year